Shiro 整合 SpringMVC 完整實戰：Maven 依賴、EhCache 共享、Realm/Filter/Session 全配置

Shiro 整合 SpringMVC 完整實戰：Maven 依賴、EhCache 共享、Realm/Filter/Session 全配置

Apache Shiro 是輕量級安全框架，支援認證、授權、加密、會話管理。本文記錄生產級整合 SpringMVC + MyBatis + EhCache 的完整配置，重點解決 Shiro 與 Hibernate 共享 EhCache 衝突、自定義 Realm 密碼重試限制、RememberMe 加密 等實戰難點。

一、Maven 核心依賴

<!-- 公共依賴 -->
<dependency><groupId>commons-collections</groupId><artifactId>commons-collections</artifactId><version>3.2.1</version></dependency>
<dependency><groupId>net.sf.ehcache</groupId><artifactId>ehcache-core</artifactId><version>2.6.9</version></dependency>

<!-- Shiro 核心 -->
<dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-spring</artifactId><version>1.2.3</version></dependency>
<dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-ehcache</artifactId><version>1.2.3</version></dependency>
<dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-quartz</artifactId><version>1.2.3</version></dependency>

二、EhCache 共享衝突解決 (關鍵！)

Hibernate 預設用 EhCacheRegionFactory，Shiro 也用 EhCache，若不隔離會導致緩存管理器非單例、數據互串。解決方案：Hibernate 強制使用 SingletonEhCacheRegionFactory。

<bean id="sessionFactory" class="org.springframework.orm.hibernate4.LocalSessionFactoryBean">
    <property name="hibernateProperties">
        <props>
            <!-- 關鍵：使用單例工廠 -->
            <prop key="hibernate.cache.region.factory_class">
                org.hibernate.cache.SingletonEhCacheRegionFactory
            </prop>
            <prop key="hibernate.cache.provider_class">
                net.sf.ehcache.hibernate.SingletonEhCacheProvider
            </prop>
            <prop key="hibernate.cache.use_second_level_cache">true</prop>
            <prop key="hibernate.cache.use_query_cache">true</prop>
            <prop key="hibernate.cache.provider_configuration_file_resource_path">
                WEB-INF/classes/ehcache.xml
            </prop>
        </props>
    </property>
</bean>

三、ehcache.xml 完整配置 (Shiro 專用緩存區)

<ehcache>
    <diskStore path="java.io.tmpdir"/>
    <defaultCache maxElementsInMemory="10000" eternal="false"
        timeToIdleSeconds="120" timeToLiveSeconds="120" overflowToDisk="true"/>

    <!-- Hibernate 專用 -->
    <cache name="org.hibernate.cache.UpdateTimestampsCache" maxElementsInMemory="5000" eternal="true" overflowToDisk="true"/>
    <cache name="org.hibernate.cache.StandardQueryCache" maxElementsInMemory="10000" eternal="false" timeToLiveSeconds="120" overflowToDisk="true"/>

    <!-- Shiro 專用緩存區 -->
    <cache name="passwordRetryCache" maxEntriesLocalHeap="2000" eternal="false"
        timeToIdleSeconds="3600" timeToLiveSeconds="0" overflowToDisk="false" statistics="true"/>
    <cache name="authorizationCache" ... />
    <cache name="authenticationCache" ... />
    <cache name="shiro-activeSessionCache" ... />
</ehcache>

四、web.xml 配置 ShiroFilter (必須在 SpringMVC Filter 之前)

<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param><param-name>targetFilterLifecycle</param-name><param-value>true</param-value></init-param>
    <async-supported>true</async-supported>
</filter>
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

五、shiro-spring.xml 核心 Bean 配置 (節選關鍵點)

<!-- 1. 緩存管理器 -->
<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
    <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
</bean>

<!-- 2. 密碼加密輔助 & 憑證匹配器 (含重試限制) -->
<bean id="passwordHelper" class="com.xxx.framework.security.PasswordHelper"/>
<bean id="credentialsMatcher" class="com.xxx.framework.security.credentials.RetryLimitSimpleCredentialsMatcher">
    <constructor-arg ref="cacheManager"/>
    <property name="passwordHelper" ref="passwordHelper"/>
</bean>

<!-- 3. Realm -->
<bean id="userRealm" class="com.xxx.framework.security.realm.UserRealm">
    <property name="userDAO" ref="shiro_user_dao"/>
    <property name="credentialsMatcher" ref="credentialsMatcher"/>
    <property name="cachingEnabled" value="true"/>
    <property name="authenticationCacheName" value="authenticationCache"/>
    <property name="authorizationCacheName" value="authorizationCache"/>
</bean>

<!-- 4. Session 管理 (集群支援) -->
<bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>
<bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">
    <property name="activeSessionsCacheName" value="shiro-activeSessionCache"/>
    <property name="sessionIdGenerator" ref="sessionIdGenerator"/>
</bean>
<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
    <property name="globalSessionTimeout" value="1800000"/> <!-- 30 分鐘 -->
    <property name="sessionDAO" ref="sessionDAO"/>
</bean>

<!-- 5. RememberMe (AES 加密 Cookie) -->
<bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
    <constructor-arg value="rememberMe"/>
    <property name="httpOnly" value="true"/>
    <property name="maxAge" value="2592000"/> <!-- 30 天 -->
</bean>
<bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
    <property name="cipherKey" value="#{T(org.apache.shiro.codec.Base64).decode('4AvVhmFLUs0KTA3Kprsdag==')}"/>
    <property name="cookie" ref="rememberMeCookie"/>
</bean>

<!-- 6. SecurityManager -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="userRealm"/>
    <property name="sessionManager" ref="sessionManager"/>
    <property name="cacheManager" ref="cacheManager"/>
    <property name="rememberMeManager" ref="rememberMeManager"/>
</bean>

<!-- 7. ShiroFilterFactoryBean (鏈路定義) -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager"/>
    <property name="loginUrl" value="/login/"/>
    <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
    <property name="filterChainDefinitions">
        <value>
            /index.jsp = anon
            /login/ = anon
            /static/** = anon
            /login/checklogin = anon  <!-- 登錄提交放行 -->
            /login/logout = logout
            /** = user  <!-- 需登錄或 RememberMe -->
        </value>
    </property>
</bean>

<!-- 8. 生命周期處理器 (支援 @RequiresPermissions 等註解) -->
<bean class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

六、實戰避坑指南

生產建議：權限表達式建議用註解 (@RequiresPermissions("user:delete")) + AOP，URL 鏈路僅做粗粒度攔截；Session 存 Redis 實現集群共享；定期輪換 RememberMe AES 密鑰。